I have a development web server that I need to add trust certificates on my local machine.

Http connections to server https://machine-name.a.b.local/ show an SSL issue.

This is the cert chain:

      • *.a.b.local

From a web browser, I can install the EFGH-SUBCA-CA cert but don't have the option to install the ABCD-CA root cert. So when I inspect the certs using the certlm snap-in or the browser, I see the message "Windows does not have enough information to verify the certificate"

Another thing I've tried is using PowerShell to create a new self-signed cert for the CA and place it in my machine's trusted root CAs. Then I create another self-signed cert for the sub-CA with the signer as the first CA and place it in my machine's intermediate CAs.

Inspecting these certs in the certlm snap-in shows they are both ok but the browser still shows the cert issue.

What am I doing wrong?

  • 1
    You need to install the root CA ABCD-CA, although it's not sent by the server *.a.b.local as a part of the chain. In other words, you must get the internal root CA certificate off-band. May 24 at 5:33
  • Is there no way for me to create a self-signed certificate in its place?
    – W. Young
    May 24 at 14:55
  • 1
    That doesn't much help if you don't have the signature in the certificate chain the server provides. May 24 at 17:43


Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.